Privacy & Information Security Law Blog

On April 11, 2011, the United States District Court for the Northern District of California declined to dismiss four of the nine claims in a class action lawsuit filed against RockYou, Inc. (“RockYou”), a publisher and developer of applications used on popular social media sites.  The suit stems from a December 2009 security breach caused by an SQL injection flaw that resulted in the exposure of unencrypted user names and passwords of approximately 32 million RockYou users.  RockYou subsequently fixed the error and acknowledged in a public statement that “one or more individuals had illegally breached its databases” and that “at the time of the breach, the hacked database had not been up to date with industry standard security protocols.”  After receiving notification of the security breach from RockYou in mid-December, on December 28, 2009, a RockYou user who had signed up for a photo-sharing application filed a complaint seeking injunctive relief and damages for himself and on behalf of all other similarly-situated individuals.

The plaintiff’s complaint (as amended on August 12, 2010) alleged that RockYou failed “to secure and safeguard users’ sensitive personally identifiable information (‘PII’), including e-mail addresses and passwords and login credentials for social networks” in violation of RockYou’s terms of service and “accepted, long-standing industry standards.”  Although RockYou’s privacy policy stated that “RockYou! uses commercially reasonable physical, managerial, and technical safeguards to preserve the integrity and security of your personal information,” the company failed to use any form of encryption to protect the PII, which was stored in “clear” or “plain text” format, and did not use “hashing, salting, or any other common and reasonable method of data protection and therefore drastically exacerbated the consequences of a hacker bypassing its outer layer of web security.”

The plaintiff asserted nine causes of action against RockYou, five of which were dismissed in the April 11, 2011 order.  The remaining four claims (breach of contract, breach of implied contract, negligence and negligence per se) were not dismissed, leaving open the possibility that RockYou could be held liable for breach of contract with respect to data security promises it made in its online privacy policy.  The following are some key points from the court’s order.

• The court ruled that the plaintiff’s allegations of harm were sufficient at that stage of the proceedings “to allege a generalized injury in fact” despite RockYou’s argument that the plaintiff had failed to sufficiently allege “any actionable harm or concrete, tangible, non-speculative harm or loss.”
• The court held that “[n]ot only is there a paucity of controlling authority regarding the legal sufficiency of plaintiff’s damages theory, but the court also takes note that the context in which plaintiff's theory arises — i.e., the unauthorized disclosure of personal information via the Internet — is itself relatively new, and therefore more likely to raise issues of law not yet settled in the courts.”  The court noted, however, that it has “doubts about plaintiff’s ultimate ability to prove his damages theory in this case.”
• RockYou challenged the plaintiff’s three contract-based claims (breach of contract, breach of implied contract, and breach of the implied covenant of good faith and fair dealing) for failure to allege any actionable damages, and argued that the “contractual claims should be dismissed because the provisions of the privacy policy maintained by defendant expressly provide that no liability will result due to a third party’s unauthorized access of defendant’s computer system.”  According to the court, however, the relevant section of RockYou’s privacy policy indicated that RockYou “assumes no liability or responsibility for . . . any unauthorized access to or use of our secure servers and/or any and all personal information and/or financial information stored therein” and thus, “since plaintiff is alleging that the servers were not, in fact, secure, this provision of the policy does not automatically preclude plaintiff’s contract claims.”
• The court refused to dismiss the plaintiff’s claims for breach of contract and breach of implied contract, but dismissed the claim for breach of the implied covenant of good faith and fair dealing because the plaintiff did not provide any “supporting or factual allegations that adequately allege the type of conscious and deliberate acts” required to prevail on this count.
• The court’s order allows the plaintiff to amend two of its claims, including the breach of implied contract claim, to re-allege any additional facts sufficient to state a proper claim.  The plaintiff has until May 11, 2011 to amend its complaint.  As the court noted, however, “[i]f it becomes apparent, through discovery, that no basis exists upon which plaintiff could legally demonstrate tangible harm via the unauthorized disclosure of personal information, the court will dismiss plaintiff’s claims for lack of standing at the dispositive motion stage.”

Update: As reported in BNA’s Privacy Law Watch, on November 14, 2011, the parties filed a proposed settlement in which RockYou agreed to pay the plaintiff $2,000, and the plaintiff’s counsel $290,000 for fees and expenses. In addition, RockYou will submit to two third party information security audits over the next three years and correct any issues identified by the audits.